firedrill-run 2.2.5 → 3.0.0

package/dist/contracts/driver-review-contracts.js

@@ -0,0 +1,99 @@
+import { driverBasisMatches } from './agent-execution-contracts.js';
+const object = (value) => Boolean(value && typeof value === 'object' && !Array.isArray(value));
+const id = (value) => typeof value === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(value);
+const hash = (value) => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const integer = (value, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) => typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum && value <= maximum;
+const text = (value, maximum) => typeof value === 'string' && value.length <= maximum && !/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(value);
+const nullableText = (value, maximum) => value === null || text(value, maximum);
+const kinds = ['conversation', 'http_task', 'browser_workflow', 'adaptive_browser', 'desktop', 'process', 'event'];
+const changes = ['current', 'added', 'removed', 'changed', 'unchanged'];
+const exact = (value, keys) => Object.keys(value).sort().join(',') === keys.sort().join(',');
+function locator(value) {
+    return object(value) && exact(value, ['kind', 'value', 'name', 'exact', 'frames', 'presentation_omitted'])
+        && ['role', 'label', 'test_id', 'text', 'css'].includes(String(value.kind)) && nullableText(value.value, 2048)
+        && nullableText(value.name, 2048) && typeof value.exact === 'boolean' && typeof value.presentation_omitted === 'boolean'
+        && Array.isArray(value.frames) && value.frames.length <= 8 && value.frames.every(one => text(one, 2048))
+        && (value.value !== null || value.presentation_omitted);
+}
+function source(value) {
+    return object(value) && exact(value, ['key', 'root', 'path', 'sha256', 'line', 'presentation_omitted'])
+        && hash(value.key) && nullableText(value.root, 128) && nullableText(value.path, 2048) && hash(value.sha256)
+        && (value.line === null || integer(value.line, 1, 2147483647)) && typeof value.presentation_omitted === 'boolean'
+        && (value.root !== null && value.path !== null || value.presentation_omitted);
+}
+function action(value) {
+    return object(value) && exact(value, ['id', 'position', 'action', 'effect', 'page', 'timeout_ms', 'locator', 'path',
+        'input_path', 'output', 'point', 'has_literal_value', 'presentation_omitted', 'source'])
+        && text(value.id, 128) && /^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(value.id)
+        && integer(value.position, 1, 10000) && text(value.action, 32)
+        && ['navigate', 'click', 'fill', 'select', 'check', 'press', 'wait_visible', 'wait_hidden', 'wait_text', 'extract', 'switch_page', 'close_page', 'upload', 'download', 'dialog', 'point'].includes(value.action)
+        && ['read', 'write'].includes(String(value.effect)) && integer(value.page, 0, 31) && integer(value.timeout_ms, 100, 300000)
+        && (value.locator === null || locator(value.locator)) && nullableText(value.path, 2048)
+        && nullableText(value.input_path, 256) && nullableText(value.output, 64)
+        && (value.point === null || Array.isArray(value.point) && value.point.length === 2 && value.point.every(one => integer(one, Number.MIN_SAFE_INTEGER)))
+        && typeof value.has_literal_value === 'boolean' && typeof value.presentation_omitted === 'boolean' && source(value.source);
+}
+function completion(value) {
+    return object(value) && exact(value, ['kind', 'label', 'locator', 'result_locator', 'page', 'attribute', 'literal_value_omitted'])
+        && ['source_dom_marker', 'process_exit', 'result_file', 'source_status_endpoint', 'not_required'].includes(String(value.kind))
+        && text(value.label, 160) && (value.locator === null || locator(value.locator))
+        && (value.result_locator === null || locator(value.result_locator)) && (value.page === null || integer(value.page, 0, 31))
+        && nullableText(value.attribute, 128) && typeof value.literal_value_omitted === 'boolean';
+}
+export function driverReviewMatches(value, world, selection = {}) {
+    if (!object(value) || !exact(value, ['schema', 'id', 'world_id', 'validation_job_id', 'contract_sha256', 'review_sha256', 'revision',
+        'kind', 'origin', 'current', 'available', 'created_at', 'source', 'configuration', 'basis', 'action_count', 'source_count',
+        'omitted_count', 'scope', 'completion', 'previous']) || value.schema !== 'firedrill.driver-review.v1'
+        || !id(value.id) || value.world_id !== world || !id(world) || !id(value.validation_job_id)
+        || selection.id !== undefined && value.id !== selection.id || selection.contract !== undefined && value.contract_sha256 !== selection.contract
+        || !hash(value.contract_sha256) || !hash(value.review_sha256) || !text(value.revision, 128) || !kinds.includes(String(value.kind))
+        || !['guest_report', 'customer_device'].includes(String(value.origin)) || typeof value.current !== 'boolean' || typeof value.available !== 'boolean'
+        || typeof value.created_at !== 'string' || !Number.isFinite(Date.parse(value.created_at))
+        || !object(value.source) || !exact(value.source, ['id', 'revision']) || !id(value.source.id) || !text(value.source.revision, 256)
+        || !object(value.configuration) || !exact(value.configuration, ['id', 'revision']) || !id(value.configuration.id) || !integer(value.configuration.revision, 1)
+        || !driverBasisMatches(value.basis) || !integer(value.action_count, 0, 10000) || !integer(value.source_count, 0, 15000)
+        || !integer(value.omitted_count) || !Array.isArray(value.scope) || value.scope.length > 64
+        || !value.scope.every(one => object(one) && exact(one, ['name', 'label', 'value', 'omitted']) && text(one.name, 128)
+            && text(one.label, 80) && nullableText(one.value, 16384) && typeof one.omitted === 'boolean')
+        || new Set(value.scope.map(one => one.name)).size !== value.scope.length
+        || !(value.completion === null || completion(value.completion)))
+        return false;
+    if (!value.available && (value.scope.length !== 0 || value.completion !== null))
+        return false;
+    return value.previous === null || object(value.previous) && exact(value.previous, ['id', 'contract_sha256', 'revision', 'kind', 'available'])
+        && id(value.previous.id) && value.previous.id !== value.id && hash(value.previous.contract_sha256)
+        && text(value.previous.revision, 128) && kinds.includes(String(value.previous.kind)) && typeof value.previous.available === 'boolean';
+}
+function page(value, world, review, selection) {
+    if (!object(value) || !exact(value, ['results', 'count', 'page', 'page_size', 'next', 'previous', 'world_id', 'review_id',
+        'review_sha256', 'baseline_id', 'baseline_review_sha256', 'query', 'change']) || value.world_id !== world || review.world_id !== world
+        || value.review_id !== review.id || value.review_sha256 !== review.review_sha256 || value.baseline_id !== (selection.baseline ?? null)
+        || value.baseline_id === null && value.baseline_review_sha256 !== null || value.baseline_id !== null && (!id(value.baseline_id) || !hash(value.baseline_review_sha256))
+        || !integer(value.count, 0, 30000) || !integer(value.page, 1) || !integer(value.page_size, 1, 100)
+        || selection.page !== undefined && value.page !== selection.page || !Array.isArray(value.results) || value.results.length > value.page_size
+        || value.query !== (selection.query ?? '').trim() || value.change !== (selection.change ?? 'all'))
+        return false;
+    const prefix = `/api/workspaces/`;
+    return [value.next, value.previous].every(one => one === null || typeof one === 'string'
+        && (one.startsWith(prefix) || /^https?:\/\//.test(one)) && !/[\x00-\x20]/.test(one));
+}
+function changed(value, baseline) {
+    return changes.includes(String(value.change)) && typeof value.omitted_change === 'boolean'
+        && (baseline === null ? value.change === 'current' && value.before === null && value.after !== null
+            : value.change !== 'current' && (value.change === 'added' ? value.before === null && value.after !== null
+                : value.change === 'removed' ? value.before !== null && value.after === null : value.before !== null && value.after !== null));
+}
+export function driverReviewActionsMatch(value, world, review, selection = {}) {
+    return page(value, world, review, selection) && new Set(value.results.map(one => object(one) ? one.key : null)).size === value.results.length
+        && value.results.every(one => object(one) && exact(one, ['key', 'change', 'before', 'after', 'omitted_change', 'order_changed'])
+            && text(one.key, 128) && changed(one, selection.baseline ?? null) && typeof one.order_changed === 'boolean'
+            && (one.before === null || action(one.before) && one.before.id === one.key)
+            && (one.after === null || action(one.after) && one.after.id === one.key));
+}
+export function driverReviewSourcesMatch(value, world, review, selection = {}) {
+    return page(value, world, review, selection) && new Set(value.results.map(one => object(one) ? one.key : null)).size === value.results.length
+        && value.results.every(one => object(one) && exact(one, ['key', 'change', 'before', 'after', 'omitted_change'])
+            && hash(one.key) && changed(one, selection.baseline ?? null)
+            && (one.before === null || source(one.before) && one.before.key === one.key)
+            && (one.after === null || source(one.after) && one.after.key === one.key));
+}

package/dist/contracts/evidence-contracts.js

@@ -0,0 +1,65 @@
+/** Private evidence identities shared by the portal, native CLI and MCP. */
+import { fileMatchesTrial } from './media-contracts.js';
+const uuid = (value) => typeof value === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value);
+const digest = (value) => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const date = (value) => typeof value === 'string' && value.length <= 64 && Number.isFinite(Date.parse(value));
+const natural = (value) => Number.isSafeInteger(value) && value >= 0;
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const categories = new Set(['message', 'driver', 'action', 'service', 'state', 'file', 'assessment', 'event']);
+const kinds = new Set(['transcript', 'tool_trace', 'trace', 'result', 'state_snapshot', 'dataset_application', 'browser_capture', 'desktop_capture', 'other',
+    'recording_combined', 'recording_stereo', 'recording_customer', 'recording_assistant', 'recording_segment']);
+function page(value) {
+    return Array.isArray(value.results) && value.results.length <= 100
+        && natural(value.count) && natural(value.page) && value.page > 0 && natural(value.page_size) && value.page_size > 0 && value.page_size <= 100
+        && (value.next === null || typeof value.next === 'string') && (value.previous === null || typeof value.previous === 'string');
+}
+export function evidenceFileMatches(value, prefix, execution) {
+    if (!record(value) || !uuid(value.id) || value.execution_id !== execution || !natural(value.attempt_number) || value.attempt_number < 1
+        || typeof value.kind !== 'string' || !kinds.has(value.kind) || !natural(value.size) || !date(value.created_at)
+        || !['guest_report', 'customer_device'].includes(String(value.origin)) || typeof value.content_type !== 'string' || value.content_type.length > 255
+        || value.filename !== `evidence-${value.id}.${value.kind === 'tool_trace' ? 'jsonl' : value.content_type === 'audio/wav' ? 'wav' : value.content_type === 'application/json' ? 'json' : 'bin'}`
+        || value.generation !== null && (typeof value.generation !== 'string' || !/^[0-9]{1,30}$/.test(value.generation))
+        || value.sha256 !== null && !digest(value.sha256) || value.expires_at !== null && !date(value.expires_at)
+        || !['available', 'expired', 'deleted', 'pending', 'unavailable'].includes(String(value.state))
+        || value.media !== null && (!record(value.media) || value.media.id !== value.id || value.state !== 'available'
+            || value.media.preview !== null && !record(value.media.preview) || value.media.audio !== null && !record(value.media.audio)
+            || !fileMatchesTrial(value.media, prefix)))
+        return false;
+    return value.state === 'available' ? digest(value.sha256) && value.generation !== null && value.download_path === `${prefix}/evidence/${value.id}/bytes`
+        : value.download_path === null;
+}
+export function evidenceManifestMatches(value, prefix, execution) {
+    return record(value) && page(value) && value.schema === 'firedrill.evidence-manifest.v1' && value.execution_id === execution && date(value.through_at)
+        && value.results.every(row => evidenceFileMatches(row, prefix, execution));
+}
+export function timelineMatches(value, prefix, execution) {
+    const selected = prefix.match(/^\/api\/workspaces\/[a-f0-9-]+\/campaigns\/([a-f0-9-]+)\/trials\/([a-f0-9-]+)$/);
+    if (!selected || selected[2] !== execution)
+        return false;
+    const portal = `/campaigns/${selected[1]}/trials/${execution}`;
+    return record(value) && page(value) && value.execution_id === execution && value.results.every(one => record(one)
+        && uuid(one.id) && one.execution_id === execution && categories.has(String(one.category)) && typeof one.label === 'string' && one.label.length <= 300
+        && (one.attempt_number === null || natural(one.attempt_number) && one.attempt_number > 0) && (one.position === null || natural(one.position))
+        && (one.observed_at === null || typeof one.observed_at === 'number' && Number.isFinite(one.observed_at) && one.observed_at > 0)
+        && date(one.recorded_at) && one.time_basis === (one.observed_at === null ? 'recorded' : 'observed')
+        && (one.evidence_id === null || uuid(one.evidence_id)) && (one.origin === null || ['guest_report', 'customer_device'].includes(String(one.origin)))
+        && (one.category === 'service' ? typeof one.receipt_available === 'boolean' && one.observed_at === null && one.evidence_id === null
+            && one.position === null && (one.receipt_available ? ['guest_report', 'customer_device'].includes(String(one.origin)) && natural(one.attempt_number) && one.attempt_number > 0
+            : one.origin === null && one.attempt_number === null && one.label === 'Service receipt unavailable') : one.receipt_available === null)
+        && one.detail_path === (one.category === 'message' ? `${prefix}/messages/${one.id}`
+            : one.category === 'action' ? `${prefix}/actions/${one.id}` : one.category === 'driver' ? `${prefix}/timeline/driver/${one.id}`
+                : one.category === 'service' ? `${prefix}/requests/${one.id}`
+                    : one.category === 'assessment' ? `${prefix}/assessments/${one.id}` : one.category === 'state' ? `${prefix}/state-comparisons/checkpoints/${one.id}` : null)
+        && one.portal_path === (one.category === 'message' ? `${portal}?view=conversation&record=${one.id}`
+            : one.category === 'action' ? `${portal}?view=actions&record=${one.id}` : one.category === 'driver' ? `${portal}?view=timeline&step=${one.id}`
+                : one.category === 'service' ? `${portal}?view=requests&request=${one.id}`
+                    : one.category === 'assessment' ? `${portal}?view=assessment&assessment=${one.id}` : one.category === 'state' ? `${portal}?view=state&checkpoint=${one.id}`
+                        : one.category === 'file' ? `${portal}?view=files&artifact=${one.id}` : `${portal}?view=timeline`));
+}
+export function driverEventMatches(value, prefix, execution, id) {
+    return record(value) && value.id === id && value.execution_id === execution && uuid(value.evidence_id) && natural(value.attempt_number)
+        && ['guest_report', 'customer_device'].includes(String(value.origin))
+        && value.attempt_number > 0 && natural(value.position) && ['observation', 'action', 'completion'].includes(String(value.kind))
+        && typeof value.summary === 'string' && digest(value.contract_sha256) && typeof value.inline_available === 'boolean'
+        && value.inline_available === (value.content !== null) && value.file_path === `${prefix}/evidence/${value.evidence_id}/bytes`;
+}

package/dist/contracts/evidence-coverage-contracts.js

@@ -0,0 +1,10 @@
+/** Coverage belongs to the selected attempt and evidence channel, not a grade. */
+export function coveragePageMatches(page, kind, attempt) {
+    const selectedAttempt = attempt?.trim();
+    return (kind === 'messages' || kind === 'actions') && page.kind === kind && page.results.every(row => Number.isSafeInteger(row.attempt_number) && row.attempt_number > 0
+        && (!selectedAttempt || row.attempt_number === Number(selectedAttempt))
+        && [...row.task_message_streams, ...row.message_streams, ...row.voice_streams, ...row.speech_measurements, ...row.operation_streams]
+            .every(stream => stream.attempt_number === row.attempt_number)
+        && (kind === 'actions' ? row.task_message_streams.length + row.message_streams.length + row.voice_streams.length + row.speech_measurements.length === 0
+            : kind === 'messages' && row.operation_streams.length === 0));
+}

package/dist/contracts/export-contracts.js

@@ -0,0 +1,44 @@
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+const executionStates = new Set(['planned', 'claimed', 'dispatching', 'running', 'reconciling', 'completed', 'failed', 'timed_out',
+    'canceled', 'platform_failed', 'platform_failed_before_start', 'canceled_before_start']);
+const exportStates = new Set(['queued', 'preparing', 'uploading', 'retained', 'failed', 'canceled', 'unavailable']);
+export function normalizedExportFilters(value) {
+    const keys = ['q', 'status', 'checks', 'scenario', 'cohort', 'assessment_status', 'score_bucket'];
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.entries(value).some(([key, one]) => !keys.includes(key) || typeof one !== 'string'))
+        return null;
+    const q = value.q ?? '', status = value.status ?? '', checks = value.checks ?? '', scenario = value.scenario?.toLowerCase() ?? '';
+    if ([...q].length > 200 || /[\u0000-\u001f\u007f]/.test(q.trim()) || status && !executionStates.has(status)
+        || checks && !['met', 'unmet', 'unassessed', 'unavailable', 'missing'].includes(checks) || scenario && !uuid.test(scenario))
+        return null;
+    const result = { q: q.trim(), status, checks, scenario };
+    if (!value.cohort)
+        return value.assessment_status || value.score_bucket ? null : result;
+    const cohort = value.cohort.toLowerCase(), assessment = value.assessment_status ?? '', bucket = value.score_bucket ?? '';
+    if (!uuid.test(cohort) || assessment && !['succeeded', 'not_assessable', 'not_applicable'].includes(assessment)
+        || bucket && (!/^[0-8]$/.test(bucket) || assessment && assessment !== 'succeeded'))
+        return null;
+    return { ...result, cohort, assessment_status: assessment, score_bucket: bucket };
+}
+function sameFilters(left, right) {
+    const first = normalizedExportFilters(left), second = normalizedExportFilters(right);
+    return first !== null && second !== null && Object.keys(first).length === Object.keys(second).length
+        && Object.entries(first).every(([key, value]) => second[key] === value);
+}
+export function reportExportMatches(value, scope, selected) {
+    return !!value && uuid.test(value.id) && uuid.test(value.actor_id) && uuid.test(value.request_key)
+        && value.workspace_id === scope.workspace && value.campaign_id === scope.campaign && (!scope.actor || value.actor_id === scope.actor)
+        && (!selected?.id || value.id === selected.id) && (!selected?.key || value.request_key === selected.key)
+        && exportStates.has(value.state) && normalizedExportFilters(value.filters) !== null
+        && (!selected?.filters || sameFilters(value.filters, selected.filters))
+        && Object.values(value.counts).every(one => Number.isSafeInteger(one) && one >= 0)
+        && (!value.file || value.state === 'retained' && Number.isSafeInteger(value.file.size) && value.file.size > 0
+            && /^[a-f0-9]{64}$/.test(value.file.sha256)
+            && value.file.download_path === `/api/workspaces/${scope.workspace}/campaigns/${scope.campaign}/report-exports/${value.id}/download`);
+}
+export function reportExportsPageMatches(value, scope) {
+    return 'results' in value && value.workspace_id === scope.workspace && value.campaign_id === scope.campaign
+        && value.results.every(row => reportExportMatches(row, scope) && row.file === null && !row.can_cancel);
+}
+export function reportExportRecoveryMatches(value, scope, key) {
+    return !('results' in value) && reportExportMatches(value, scope, { key });
+}

package/dist/contracts/github-directory-contracts.js

@@ -0,0 +1,96 @@
+const connectionFailures = {
+    github_connection_expired: 'GitHub authorization expired or your workspace access changed. Authorize GitHub again to continue.',
+    github_installation_denied: 'This GitHub account cannot access the selected installation. Choose an authorized account or update GitHub access.',
+    github_connection_retry: 'GitHub could not confirm this authorization. Check your connected accounts below, then authorize GitHub again if needed.',
+    github_connection_failed: 'The GitHub connection was not confirmed. Check your connected accounts below before authorizing again.',
+};
+export function gitHubConnectionFailure(reason) {
+    return reason && Object.prototype.hasOwnProperty.call(connectionFailures, reason) ? connectionFailures[reason] : null;
+}
+export const gitHubId = (value) => typeof value === 'string' && /^[1-9][0-9]{0,18}$/.test(value) && BigInt(value) < 2n ** 63n;
+const uuid = (value) => typeof value === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value);
+const text = (value, maximum, empty = false) => typeof value === 'string' && (empty || value.length > 0)
+    && value.length <= maximum && !/[\x00-\x1f\x7f]/.test(value);
+const date = (value) => typeof value === 'string' && value.length <= 64 && Number.isFinite(Date.parse(value));
+export function gitHubConnectionMatches(value, workspace, installation) {
+    return !!value && uuid(value.id) && value.workspace_id === workspace && value.installation_id === installation && gitHubId(installation)
+        && text(value.account, 255) && text(value.state, 24) && date(value.verified_at) && (value.disconnected_at === null || date(value.disconnected_at));
+}
+export function gitHubConnectionChangeMatches(value, original) {
+    if (!value || value.workspace_id !== original.workspace || value.installation_id !== original.installation
+        || value.actor_id !== original.actor || value.request_key !== original.key || value.connection_id !== original.connection_id
+        || !text(value.current_connection_state, 24) || !date(value.current_verified_at))
+        return false;
+    if (value.state === 'not_received')
+        return value.connection_verified_at === null && value.disconnected_at === null
+            && value.cleanup_state === null && value.cleanup_completed_at === null;
+    return value.state === 'received' && value.connection_verified_at === original.verified_at && date(value.disconnected_at)
+        && (value.cleanup_state === 'pending' || value.cleanup_state === 'recovery_required') && value.cleanup_completed_at === null
+        || value.state === 'received' && value.connection_verified_at === original.verified_at && date(value.disconnected_at)
+            && value.cleanup_state === 'complete' && date(value.cleanup_completed_at);
+}
+export function gitHubConnectionsMatch(value, workspace, query, page) {
+    return !!value && value.workspace_id === workspace && value.query === query.trim() && pageMatches(value, page)
+        && value.results.every(row => gitHubConnectionMatches(row, workspace, row.installation_id));
+}
+export function gitHubConnectionChangesMatch(value, workspace, actor, page) {
+    return !!value && value.workspace_id === workspace && value.actor_id === actor && pageMatches(value, page)
+        && value.results.every(row => row.state === 'received' && uuid(row.request_key) && uuid(row.connection_id) && date(row.connection_verified_at)
+            && gitHubConnectionChangeMatches(row, { workspace, actor, installation: row.installation_id, key: row.request_key,
+                connection_id: row.connection_id, verified_at: row.connection_verified_at }));
+}
+export function gitHubRead(value, matches) {
+    if (!matches)
+        throw new Error('The GitHub response did not match the selected workspace, account or original request. Check the connection before continuing.');
+    return value;
+}
+function pageMatches(value, page) {
+    return value.page === page && Number.isSafeInteger(value.page) && value.page >= 1 && Number.isSafeInteger(value.page_size)
+        && value.page_size >= 1 && value.page_size <= 100 && Number.isSafeInteger(value.count) && value.count >= 0
+        && Array.isArray(value.results) && value.results.length <= value.page_size;
+}
+export function gitHubAccountMatches(value, workspace, installation) {
+    return !!value && value.workspace_id === workspace && gitHubId(value.id) && (!installation || installation === value.id)
+        && text(value.account, 255) && (value.avatar_url === null || typeof value.avatar_url === 'string' && value.avatar_url.length <= 2048);
+}
+export function gitHubAccountsMatch(value, workspace, query = '', page = 1) {
+    return !!value && value.workspace_id === workspace && value.query === query.trim() && pageMatches(value, page)
+        && value.results.every(row => gitHubAccountMatches(row, workspace));
+}
+export function gitHubSyncMatches(value, workspace, installation, original) {
+    return !!value && value.workspace_id === workspace && value.installation_id === installation && gitHubId(installation)
+        && [value.id, value.workspace_id, value.actor_id, value.request_key].every(uuid)
+        && (!original || value.actor_id === original.actor && value.request_key === original.key && (!original.id || original.id === value.id))
+        && ['pending', 'ready', 'failed', 'canceled'].includes(value.state) && typeof value.observed_count === 'string'
+        && /^(0|[1-9][0-9]*)$/.test(value.observed_count) && value.observed_count.length <= 19 && BigInt(value.observed_count) < 2n ** 63n
+        && (value.completed_at === null || Number.isFinite(Date.parse(value.completed_at)));
+}
+export function gitHubRepositoriesMatch(value, workspace, installation, query = '', page = 1) {
+    return !!value && value.workspace_id === workspace && value.installation_id === installation && value.query === query.trim()
+        && pageMatches(value, page) && typeof value.directory_ready === 'boolean' && gitHubSyncMatches(value.sync, workspace, installation)
+        && value.results.every(row => gitHubId(row.id) && text(row.full_name, 512) && row.full_name.split('/').length === 2
+            && row.full_name.split('/').every(Boolean) && typeof row.description === 'string' && row.description.length <= 2048
+            && (row.default_branch === null || text(row.default_branch, 512, true)) && typeof row.private === 'boolean');
+}
+export function gitHubRequestMatches(value, workspace, installation, original) {
+    return !!value && value.workspace_id === workspace && value.installation_id === installation && value.actor_id === original.actor
+        && value.request_key === original.key && (value.state === 'not_received' ? value.sync === null && !original.id
+        : value.state === 'received' && value.sync !== null && gitHubSyncMatches(value.sync, workspace, installation, original));
+}
+export function gitHubBranchesMatch(value, workspace, installation, repository, page) {
+    return !!value && value.workspace_id === workspace && value.installation_id === installation && value.repository_id === repository
+        && gitHubId(installation) && gitHubId(repository) && value.page === page && Number.isSafeInteger(page) && page >= 1 && page <= 99999999
+        && typeof value.has_next === 'boolean' && value.has_previous === (page > 1) && Array.isArray(value.results) && value.results.length <= 25
+        && value.results.every(row => text(row.name, 512));
+}
+export function gitHubHandoff(value, workspace) {
+    try {
+        const url = new URL(value.url);
+        if (value.workspace_id === workspace && url.protocol === 'https:' && url.hostname === 'github.com' && !url.port
+            && !url.username && !url.password && !url.hash && /^\/apps\/[a-zA-Z0-9_-]+\/installations\/new$/.test(url.pathname)
+            && [...url.searchParams.keys()].join(',') === 'state' && /^[a-zA-Z0-9_-]{32,256}$/.test(url.searchParams.get('state') ?? ''))
+            return url.href;
+    }
+    catch { /* Opaque setup URL stays out of errors and retained history. */ }
+    throw new Error('The GitHub installation page could not be confirmed. Start setup again.');
+}

package/dist/contracts/insight-contracts.js

@@ -0,0 +1,11 @@
+export function findingsMatch(value, selected) {
+    return value.campaign_id === selected.campaign && value.filters.q === selected.query.trim()
+        && value.filters.scenario === (selected.scenario ?? null)
+        && value.sample_selection === 'first_retained_trial_per_observed_outcome'
+        && value.results.every(row => !selected.scenario || row.id === selected.scenario.toLowerCase());
+}
+export function insightsMatch(value, campaign) {
+    return value.campaign_id === campaign && value.proposals.length <= value.proposal_page_size
+        && value.proposal_count >= value.proposals.length
+        && (value.state !== 'unavailable' || !value.content && !value.proposals.length && !value.can_apply);
+}

package/dist/contracts/inspection-contracts.js

@@ -0,0 +1 @@
+export {};

package/dist/contracts/local-claim-contracts.js

@@ -0,0 +1,39 @@
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(v);
+const date = (v) => typeof v === 'string' && Number.isFinite(Date.parse(v));
+const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const integer = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+export function localAssignmentMatches(v, selected) {
+    if (!v || v.actor_id !== selected.actor || v.workspace_id !== selected.workspace || v.device_key !== selected.device
+        || !uuid(v.native_session_id) || selected.nativeSession && v.native_session_id !== selected.nativeSession
+        || !uuid(v.job_id) || selected.job && v.job_id !== selected.job || !uuid(v.world_id) || selected.world && v.world_id !== selected.world
+        || !uuid(v.grant_id) || typeof v.world_name !== 'string' || !hex(v.payload_digest) || v.provenance !== 'customer_device'
+        || !['validation', 'trial', 'world_session'].includes(v.purpose)
+        || !['received', 'queued', 'admitted', 'provisioning', 'running', 'finalizing', 'awaiting_validation', 'cleaning_up', 'retry_wait', 'completed', 'failed', 'canceled'].includes(v.job_state)
+        || ![v.deadline_at, v.created_at, v.server_time].every(date))
+        return false;
+    const session = v.world_session;
+    if (v.purpose === 'world_session' ? !session || !uuid(session.session_id) || !uuid(session.configuration_id) || !hex(session.input_sha256) || !date(session.expires_at)
+        : session !== undefined)
+        return false;
+    if (v.claim === null)
+        return v.input_preparation === undefined;
+    const claim = v.claim, input = v.input_preparation;
+    return !!claim && uuid(claim.id) && uuid(claim.request_key) && (!selected.request || claim.request_key === selected.request)
+        && ['claimed', 'draining', 'withdrawn', 'reconciling', 'expired'].includes(claim.state) && date(claim.expires_at)
+        && integer(claim.last_sequence) && (claim.last_pulse_digest === null || hex(claim.last_pulse_digest))
+        && (claim.request_digest === null ? claim.state === 'withdrawn' && claim.attempt_id === null : hex(claim.request_digest) && uuid(claim.attempt_id))
+        && typeof claim.cleanup_recorded === 'boolean' && claim.cleanup_provenance === (claim.cleanup_recorded ? 'customer_device' : null)
+        && !!input && ['pending', 'preparing', 'ready', 'failed'].includes(input.state)
+        && (input.problem === null || typeof input.problem === 'string') && (input.state !== 'failed' || !!input.problem);
+}
+export function localClaimLookupMatches(v, selected) {
+    return localAssignmentMatches(v, selected) && v.request_key === selected.request && v.claim_retained === (v.claim !== null);
+}
+export function localAssignmentsMatch(v, selected, filters = {}) {
+    return !!v && v.actor_id === selected.actor && v.workspace_id === selected.workspace && v.device_key === selected.device
+        && v.world_id === (filters.world ?? null) && v.campaign_id === (filters.campaign ?? null) && v.query === (filters.query ?? '').trim()
+        && v.available === (filters.available ?? false) && v.page === (filters.page ?? 1) && integer(v.count) && integer(v.page_size)
+        && v.page_size >= 1 && v.page_size <= 100 && Array.isArray(v.results) && v.results.length <= v.page_size
+        && new Set(v.results.map(one => one.job_id)).size === v.results.length
+        && v.results.every(one => localAssignmentMatches(one, { ...selected, world: filters.world ?? selected.world }));
+}

package/dist/contracts/local-configuration-contracts.js

@@ -0,0 +1,7 @@
+export function localConfigurationIdentityMatches(value, selected) {
+    return !!value && value.schema === 'firedrill.local-runtime-configuration.v1'
+        && value.actor_id === selected.owner && value.workspace_id === selected.workspace && value.native_session_id === selected.nativeSession
+        && value.device_key === selected.device && value.job_id === selected.job && value.request_key === selected.request
+        && value.lease_id === selected.lease && value.operation_id === selected.lease && value.attempt_id === selected.attempt
+        && value.provenance === 'customer_device';
+}

package/dist/contracts/local-evidence-contracts.js

@@ -0,0 +1,32 @@
+const date = (v) => typeof v === 'string' && Number.isFinite(Date.parse(v));
+const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const integer = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+export function localHistoryIdentityMatches(value, selected) {
+    return !!value && value.actor_id === selected.owner && value.workspace_id === selected.workspace && value.device_key === selected.device
+        && value.job_id === selected.job && value.request_key === selected.request && value.lease_id === selected.lease && value.attempt_id === selected.attempt
+        && value.manifest_sha256 === selected.manifestSha256 && value.provenance === 'customer_device' && date(value.server_time);
+}
+export function localEvidenceReceiptMatches(value, selected, key) {
+    if (!localHistoryIdentityMatches(value, selected) || value.transfer_key !== key || value.cloud_completion_recorded !== false
+        || !['not_retained', 'receiving', 'verifying', 'retained', 'refused', 'expired', 'unavailable'].includes(value.state)
+        || typeof value.upload_available !== 'boolean' || typeof value.authorization_current !== 'boolean' || !date(value.upload_until)
+        || !Array.isArray(value.chunks) || value.chunks.length > 512 || new Set(value.chunks.map(one => one.index)).size !== value.chunks.length
+        || value.chunks.some(one => !integer(one.index) || one.index > 511 || !integer(one.size) || one.size < 1 || one.size > 1024 ** 2
+            || !hex(one.sha256) || typeof one.retained !== 'boolean'))
+        return false;
+    if (value.state === 'not_retained')
+        return value.document === null && value.request_digest === null && value.artifact === null && value.chunks.length === 0;
+    if (!value.document || !hex(value.request_digest))
+        return false;
+    const artifact = value.artifact;
+    return value.state === 'retained' ? !!artifact && /^[a-f0-9-]{36}$/.test(artifact.id) && hex(artifact.sha256)
+        && integer(artifact.size) && /^[1-9][0-9]{0,30}$/.test(artifact.generation) : artifact === null;
+}
+export function localClosingReceiptMatches(value, selected) {
+    return localHistoryIdentityMatches(value, selected) && value.schema === 'firedrill.local-completion-receipt.v1'
+        && value.independently_attested === false && typeof value.received === 'boolean' && typeof value.settled === 'boolean'
+        && typeof value.cleanup_recorded === 'boolean' && (value.received ? value.document !== null && hex(value.digest) && value.cleanup_recorded
+        : value.document === null && value.digest === null && !value.cleanup_recorded && !value.settled)
+        && ['received', 'queued', 'admitted', 'provisioning', 'running', 'finalizing', 'awaiting_validation', 'cleaning_up', 'retry_wait', 'completed', 'failed', 'canceled'].includes(value.job_state)
+        && (!value.settled || ['completed', 'failed', 'canceled'].includes(value.job_state));
+}

package/dist/contracts/local-grant-contracts.js

@@ -0,0 +1,83 @@
+import { localRuntimeImageMatches } from './local-runner-contracts.js';
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(v);
+const date = (v) => typeof v === 'string' && Number.isFinite(Date.parse(v));
+const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const integer = (v, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) => typeof v === 'number' && Number.isSafeInteger(v) && v >= minimum && v <= maximum;
+const operations = (v) => Array.isArray(v) && v.length <= 3
+    && v.every(one => ['trial', 'validation', 'world_session'].includes(one)) && new Set(v).size === v.length;
+export function localGrantRead(v, matches) {
+    if (!matches)
+        throw new Error('The saved local permission did not match this account, world, device or original approval. No local work was started.');
+    return v;
+}
+export function localGrantBasisMatches(v) {
+    return !!v && integer(v.world_revision, 1) && integer(v.config_revision, 1) && uuid(v.source_id) && uuid(v.source_snapshot_id)
+        && typeof v.source_revision === 'string' && v.source_revision.length > 0 && v.source_revision.length <= 128
+        && hex(v.source_sha256) && hex(v.source_content_digest) && hex(v.configuration_digest)
+        && (v.source_set === undefined || localGrantSourceSetMatches(v.source_set))
+        && (v.world_definition === null || !!v.world_definition && uuid(v.world_definition.artifact_id) && hex(v.world_definition.sha256)
+            && typeof v.world_definition.generation === 'string' && /^[1-9][0-9]*$/.test(v.world_definition.generation));
+}
+export function localGrantSourceSetMatches(v) {
+    return !!v && uuid(v.id) && [v.source_set_sha256, v.graph_sha256, v.roots_sha256].every(hex) && integer(v.root_count, 1, 128);
+}
+export function localGrantSourceRootsMatch(v, actor, workspace, world, device, session, basisDigest, sourceSet, page) {
+    return !!v && v.actor_id === actor && v.workspace_id === workspace && v.world_id === world && v.device_key === device
+        && v.native_session_id === session && v.basis_sha256 === basisDigest && hex(basisDigest)
+        && localGrantSourceSetMatches(v.source_set) && ['id', 'source_set_sha256', 'graph_sha256', 'roots_sha256', 'root_count']
+        .every(key => v.source_set[key] === sourceSet[key])
+        && v.page === page && integer(v.page_size, 1, 100) && v.count === sourceSet.root_count && Array.isArray(v.results)
+        && v.results.length === Math.min(v.page_size, Math.max(0, v.count - (page - 1) * v.page_size))
+        && (v.next === null || typeof v.next === 'string') && (v.previous === null || typeof v.previous === 'string')
+        && (v.next !== null) === (page * v.page_size < v.count) && (v.previous !== null) === (page > 1)
+        && v.results.every(row => !!row && /^[a-z][a-z0-9_-]{0,63}$/.test(row.alias) && uuid(row.source_id) && uuid(row.snapshot_id)
+            && typeof row.revision === 'string' && row.revision.length > 0 && row.revision.length <= 128 && hex(row.snapshot_sha256)
+            && typeof row.generation === 'string' && /^[1-9][0-9]*$/.test(row.generation) && typeof row.label === 'string' && row.label.length <= 512
+            && row.directory === `components/${row.alias}` && (row.content_digest === null || hex(row.content_digest)))
+        && new Set(v.results.map(row => row.alias)).size === v.results.length && new Set(v.results.map(row => row.source_id)).size === v.results.length;
+}
+export function localGrantMatches(v, actor, workspace, selected = {}) {
+    if (!v || v.actor_id !== actor || v.workspace_id !== workspace || !uuid(v.id) || !uuid(v.request_key) || !uuid(v.device_key)
+        || !uuid(v.native_session_id) || !uuid(v.world_id) || selected.world && v.world_id !== selected.world || selected.device && v.device_key !== selected.device
+        || selected.key && v.request_key !== selected.key || selected.id && v.id !== selected.id
+        || typeof v.device_label !== 'string' || typeof v.world_name !== 'string' || typeof v.world_available !== 'boolean'
+        || !['active', 'revoked', 'expired', 'access_removed', 'superseded'].includes(v.state)
+        || ![v.server_time, v.expires_at, v.created_at].every(date) || !operations(v.operations) || !v.basis)
+        return false;
+    if (v.request_digest === null)
+        return v.state === 'revoked' && v.runtime === null && v.limits === null && v.consent === null
+            && v.operations.length === 0 && Object.keys(v.basis).length === 0;
+    return hex(v.request_digest) && localGrantBasisMatches(v.basis) && !!v.runtime && localRuntimeImageMatches(v.runtime)
+        && v.operations.length > 0 && !!v.limits && integer(v.limits.parallelism, 1, 10000) && integer(v.limits.cpu_units, 1, 65536)
+        && integer(v.limits.memory_mb, 1024, 16777216) && !!v.consent && v.consent.policy === 'firedrill.local-execution-consent.v1'
+        && v.consent.cloud_context_processing === true && v.consent.run_metadata === true
+        && [v.consent.evidence_upload, v.consent.vault_values_to_device, v.consent.real_account_access, v.consent.catalog_packages_to_device].every(one => typeof one === 'boolean');
+}
+export function localGrantLookupMatches(v, actor, workspace, world, key) {
+    return !!v && v.actor_id === actor && v.workspace_id === workspace && v.world_id === world && v.request_key === key
+        && (v.state === 'not_retained' || localGrantMatches(v, actor, workspace, { world, key }));
+}
+export function localGrantsMatch(v, actor, workspace, selected) {
+    return !!v && v.actor_id === actor && v.workspace_id === workspace && v.world_id === selected.world && v.device_key === (selected.device ?? null)
+        && v.grant_id === (selected.grant ?? null) && v.purpose === (selected.purpose ?? '') && v.available === (selected.available ?? false)
+        && v.query === (selected.query ?? '').trim() && v.page === (selected.page ?? 1) && integer(v.count) && integer(v.page_size, 1, 100)
+        && Array.isArray(v.results) && v.results.length <= v.page_size && new Set(v.results.map(one => one.id)).size === v.results.length
+        && v.results.every(one => localGrantMatches(one, actor, workspace, { world: selected.world ?? undefined, device: selected.device, id: selected.grant })
+            && (!selected.purpose || one.operations.includes(selected.purpose)));
+}
+export function localGrantOfferMatches(v, actor, workspace, world, device) {
+    const values = v?.disclosures;
+    return !!v && v.actor_id === actor && v.workspace_id === workspace && v.world_id === world && v.device_key === device
+        && uuid(v.native_session_id) && v.schema === 'firedrill.local-grant-offer.v1' && typeof v.world_name === 'string' && date(v.server_time)
+        && localGrantBasisMatches(v.basis) && operations(v.operations) && v.operations.length === 3 && Array.isArray(v.runtimes)
+        && v.runtimes.length <= 1 && v.runtimes.every(localRuntimeImageMatches) && !!values
+        && [values.real_connections, values.target_model_connections, values.catalog_packages].every(one => integer(one))
+        && [values.vault_values, values.local_values].every(list => Array.isArray(list) && list.every(one => one && typeof one.name === 'string'
+            && ['build', 'runtime', 'both'].includes(one.phase)));
+}
+export function localGrantWorld(prefix, workspace) {
+    const world = prefix.split('/').at(-1);
+    if (!uuid(world) || prefix !== `/api/workspaces/${workspace}/worlds/${world}`)
+        throw new Error('Open this world in its selected workspace.');
+    return world;
+}

package/dist/contracts/local-input-contracts.js

@@ -0,0 +1,19 @@
+const integer = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+export function localInputIdentityMatches(v, selected) {
+    return !!v && v.actor_id === selected.owner && v.workspace_id === selected.workspace && v.native_session_id === selected.nativeSession
+        && v.device_key === selected.device && v.job_id === selected.job && v.request_key === selected.request && v.lease_id === selected.lease && v.attempt_id === selected.attempt;
+}
+export function localInputPacketMatches(v, selected, requested = {}) {
+    return localInputIdentityMatches(v, selected) && v.schema === 'firedrill.local-input-response.v1'
+        && hex(v.manifest_sha256) && !!v.manifest && v.manifest.schema === 'firedrill.local-input-manifest.v1'
+        && v.manifest.job_id === selected.job && integer(v.offset) && (!requested.part || v.part === requested.part)
+        && (requested.offset === undefined || v.offset === requested.offset)
+        && (v.part === 'manifest' ? v.offset === 0 : ['source', 'candidate', 'compiled', 'scenarios', 'packages', 'dataset', 'checkpoint', 'application_checkpoint'].includes(v.part)
+            && integer(v.length) && v.length >= 1 && v.length <= 256 * 1024 && (requested.length === undefined || v.length === requested.length)
+            && typeof v.content_base64 === 'string' && v.content_base64.length === 4 * Math.ceil(v.length / 3) && hex(v.chunk_sha256));
+}
+export function localInputPendingMatches(v, selected) {
+    return localInputIdentityMatches(v, selected) && v.schema === 'firedrill.local-input-pending.v1'
+        && ['preparing_packages', 'preparing_starting_data'].includes(v.input_state) && v.retry_after_ms === 1000;
+}

package/dist/contracts/local-runner-contracts.js

@@ -0,0 +1,42 @@
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(v);
+const date = (v) => typeof v === 'string' && Number.isFinite(Date.parse(v));
+const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const integer = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+export function localRunnerRead(v, matches) {
+    if (!matches)
+        throw new Error('The local runner response did not match this account, workspace or original device. No local work was started.');
+    return v;
+}
+export function localRunnerMatches(v, actor, workspace, device) {
+    if (!v || v.actor_id !== actor || v.workspace_id !== workspace || !uuid(v.device_key) || device && v.device_key !== device
+        || !uuid(v.native_session_id) || !date(v.server_time) || !date(v.created_at) || !date(v.expires_at)
+        || typeof v.label !== 'string' || v.label.length < 1 || v.label.length > 80 || !v.host || typeof v.host !== 'object'
+        || !['enrolled', 'idle', 'draining', 'stopped', 'offline', 'revoked', 'expired', 'access_removed'].includes(v.state)
+        || v.provenance !== 'customer_device' || !integer(v.last_sequence)
+        || ![v.last_seen_at, v.presence_until].every(one => one === null || date(one))
+        || ![v.enrollment_digest, v.last_pulse_digest].every(one => one === null || hex(one)))
+        return false;
+    const host = v.host;
+    return v.enrollment_digest === null ? v.state === 'revoked' && Object.keys(host).length === 0
+        : Object.keys(host).length === 2 && ['darwin', 'linux'].includes(host.os ?? '') && ['x64', 'arm64'].includes(host.arch ?? '');
+}
+export function localRunnerLookupMatches(v, actor, workspace, device) {
+    return !!v && v.actor_id === actor && v.workspace_id === workspace && v.device_key === device && uuid(device) && date(v.server_time)
+        && (v.state === 'not_retained' || localRunnerMatches(v, actor, workspace, device));
+}
+export function localRunnersMatch(v, actor, workspace, query, page = 1) {
+    return !!v && v.actor_id === actor && v.workspace_id === workspace && v.query === query.trim() && v.page === page
+        && integer(v.count) && integer(v.page_size) && v.page_size >= 1 && v.page_size <= 100 && Array.isArray(v.results)
+        && v.results.length <= v.page_size && new Set(v.results.map(one => one.device_key)).size === v.results.length
+        && v.results.every(one => localRunnerMatches(one, actor, workspace));
+}
+export function localRuntimeCatalogMatches(v, actor, workspace) {
+    return !!v && v.actor_id === actor && v.workspace_id === workspace && v.schema === 'firedrill.local-runtime-catalog.v1'
+        && Array.isArray(v.runtimes) && v.runtimes.length <= 2 && new Set(v.runtimes.map(one => one.arch)).size === v.runtimes.length
+        && v.runtimes.every(localRuntimeImageMatches);
+}
+export function localRuntimeImageMatches(one) {
+    return !!one && ['amd64', 'arm64'].includes(one.arch) && one.os === 'linux' && one.profile === 'firedrill.local-container.v1'
+        && typeof one.source_revision === 'string' && /^[a-f0-9]{40}$/.test(one.source_revision) && typeof one.image === 'string'
+        && /^[a-z][a-z0-9-]{0,62}-docker\.pkg\.dev\/[a-z][a-z0-9-]{4,62}\/[a-z][a-z0-9-]{0,62}\/[a-z][a-z0-9-]{0,62}@sha256:[a-f0-9]{64}$/.test(one.image);
+}